J. Section 164.532--Transition Provisions
1. Research Transition
December 2000 Privacy Rule
The December 2000 Privacy Rule at Sec. 164.532 contained different transition requirements for research being conducted with an individual's legal permission that included treatment, and for research being conducted with an individual's legal permission that did not include treatment. However, the Rule did not explicitly address transition provisions for research studies ongoing after the compliance date where the legal permission of the individual had not been sought.
March 2002 NPRM
Several commenters found the transition provisions for research to be confusing, and further noted that December 2000 Privacy Rule did not address research ongoing after the compliance date where the legal permission of the individual had not been sought. To address these concerns, the Department proposed several revisions to the Privacy Rule's transition provisions. In particular, the Department proposed that there be no distinction in the transition provisions between research that includes treatment and research that does not, and no distinction between the requirements for research conducted with a patient's legal permission and research conducted with an IRB- approved waiver of a patient's informed consent. In sum, the NPRM proposed that covered entities be permitted to use or disclose protected health information created or received for a specific research study before the compliance date (if there was no agreed-to restriction in accordance with Sec. 164.522(a)), if the covered entity has obtained, prior to the compliance date, any one of the following: (1) An authorization or other express legal permission from an individual to use or disclose protected health information for the research study; (2) the informed consent of the individual to participate in the research study; or (3) a waiver, by an IRB of informed consent for the research study in accordance with the Common Rule or FDA's human subject protection regulations. However, even if the researcher obtained, from an IRB, a waiver of informed consent, an authorization would be required if informed consent is later obtained. This may occur if there is a temporary waiver of informed consent for emergency research under the Food and Drug Administration human subject protection regulations.
Overview of Public Comments
The following discussion provides an overview of the public comment received on this proposal. Additional comments received on this issue are discussed below in the section entitled, "Response to Other Public Comments."
Most commenters supported the proposed revisions to the Privacy Rule's transition provisions for research. However, a few commenters requested that the transition provisions be broadened to permit covered entities to rely on an express legal permission or informed consent approved by an IRB before the compliance date, even if the permission or consent had not been signed by the individual prior to the compliance date. Consequently, a researcher could use the same forms throughout their study, decreasing the chance of introducing error into the research through the use of multiple recruitment procedures, disruption to the research, and the burden for the IRBs and researchers. A few other commenters suggested that covered entities be permitted to use and disclose protected health information with consent forms approved by an IRB prior to the compliance date until the next review by the IRB, as required by the Common Rule. They argued that this would result in all informed consent forms being in compliance with the Privacy Rule's authorization regulations within a one-year period, and it would avoid disruption to ongoing research, as well as a flood of consent form revision requests to the IRBs.
The Department agrees with the majority of comments that supported the modifications to the transition provisions, and has therefore adopted the research transition modifications as proposed in the NPRM. The Department disagrees with the comments that suggest broadening the transition provisions to permit covered entities to rely on an express legal permission or informed consent that had not been signed by the individual before the compliance date. The Department understands that this provision may disrupt some ongoing research; however, the recruitment periods for some studies may continue long after the compliance date, and it would be unreasonable to grandfather-in existing informed consent documents indefinitely. While the commenter’s suggestion to only grandfather-in such informed consent documents until the next review by the IRB would address this concern, the Privacy Rule does not require initial or continuing IRB or Privacy Board review of authorization forms or informed consent documents. Therefore, the Department does not adopt this change to its proposal. However, the Department understands that some existing express legal permissions, informed consents, or IRB-approved waivers of informed consents are not study specific. Therefore, the final Rule permits covered entities to rely on an express legal permission, informed consent, or IRB-approved waiver of informed
consent for future unspecified research, provided the legal permission, informed consent or IRB-approved waiver was obtained prior to the compliance date.
Response to Other Public Comments
Comment: A commenter requested that the transition provision be narrowed by requiring research that received a waiver of informed consent from an IRB prior to the compliance date but that begins after the compliance date be re-evaluated under the Privacy Rule's waiver criteria.
Response: The Department disagrees. Given that the Privacy Rule's waiver criteria for an individual's authorization generally are consistent with the same types of considerations currently applied to a waiver of an individual's informed consent, this suggestion would impose unnecessary burdens on researchers, IRBs, and Privacy Boards, with respect to the few research studies that would fall in this category.